1. Rules #
What Kibana watches.
Rule types #
| Rule type | Usage |
|---|---|
| Elasticsearch query (KQL, DSL or ES|QL) | Alert when a query returns results or exceeds a threshold |
| Custom threshold | Threshold on an aggregation of logs or metrics, with grouping |
| Log threshold | Number of logs matching a criterion |
| APM (latency, error rate, anomaly) | Thresholds on instrumented services |
| SLO burn rate | Error budget consumption |
| Index threshold | Simple aggregation on an index |
// Règle ES|QL : plus de 50 erreurs 5xx en 5 minutes pour un service
FROM logs-*
| WHERE @timestamp > NOW() - 5 minutes AND http.response.status_code >= 500
| STATS erreurs = COUNT(*) BY service.name
| WHERE erreurs > 502. Connectors and actions #
Where notifications go.
Configuring #
A connector (email, Slack, Teams, webhook, PagerDuty, Jira, ServiceNow, index, server log...) is defined once and reused by rules. Each action picks a connector, a message (with variables such as {{context.message}} or {{alert.id}}) and a frequency.
| Setting | Effect |
|---|---|
| Check frequency | Every minute, 5 minutes... |
| Summary or per alert | One grouped notification or one per alert |
| Notify on status change | Avoids repetitions |
| Maintenance windows | Suspend notifications during an intervention |
| Recovered | Notify when the alert resolves |
Good to know: Depending on the Elastic license, some connectors (Slack, webhook, PagerDuty...) are not available on the free license; the Index and Server log connectors are.
3. SLOs #
Objectives in Elastic Observability.
Defining an SLO #
The SLO application computes an SLI from a query (custom KQL, APM metrics, histogram), a target (99.5%) and a window (rolling 30 days), then automatically creates burn rate alerts.
Indicateur : Custom query
Index : logs-nginx.access-*
Bons événements : http.response.status_code < 500
Total : *
Objectif : 99.5 % sur 30 jours glissants
Alerte : burn rate (fenêtres longues et courtes) vers le connecteur d'astreinteGood practice: The concepts (ratio SLI, budget, multi-window burn rate) are those detailed in the SRE course: mastering them makes these screens immediately understandable.
My progress
Sign in to track your progress and take notes. Sign in
💬 Questions about this lesson
No questions yet: be the first to ask for help or share your configuration.
Recommended Articles
Advanced Kibana: data views, Lens, dashboards, alerting and reporting
Use Kibana in depth: data views and runtime fields, Discover, Lens and formulas, dashboards and c...
Kibana and Elastic Observability best practices
Checklist for running Kibana in production: versions, security, spaces and roles, versioned dashb...
Elastic Security: SIEM, detection rules and investigation
Use Elastic Security as a SIEM: ECS data sources, detection rule types (query, EQL, ES|QL, thresh...
Generating Prometheus SLOs with Sloth
Describe an SLO in a few lines with Sloth and automatically generate multi-window recording rules...
Machine learning in Elastic: anomaly detection and AIOps
Automatically detect abnormal behaviour: anomaly detection jobs, datafeeds, detectors, influencer...
Elastic path project: centralising and using logs
The validation project of the "Elastic Stack mastery" path: Elastic Agent and Fleet, Logstash, El...
Alerting on error budget burn rate (multi-window burn rate)
Why alert on burn rate rather than a threshold, and how to build the multi-window, multi-burn-rat...
Kibana Maps and Canvas: geographic maps and presentations
Build maps with Kibana Maps (document, aggregation and choropleth layers, ES|QL) and dynamic pres...
Elastic Observability: logs, infrastructure, APM and synthetics
Elastic Observability features: log exploration, infrastructure inventory with Elastic Agent and ...